CVE-2025-14874
published 2025-12-18CVE-2025-14874: A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.42%
34.1th percentile
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-nodemailer | < node-nodemailer 7.0.12+~7.0.5-1 (forky) | node-nodemailer 7.0.12+~7.0.5-1 (forky) |
| nodemailer | nodemailer | < 7.0.11 | 7.0.11 |
| nodemailer | nodemailer | >= 0 < 7.0.11 | 7.0.11 |
| redhat | advanced_cluster_management_for_kubernetes | — | — |
| redhat | ceph_storage | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion
osv·2025-12-18
CVE-2025-14874 [MEDIUM] Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion
Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rcmh-qjqh-p98v. This link is maintained to preserve external references.
## Original Description
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
OSV
CVE-2025-14874: A flaw was found in Nodemailer
osv·2025-12-18·CVSS 7.5
CVE-2025-14874 [HIGH] CVE-2025-14874: A flaw was found in Nodemailer
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
OSV
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
osv·2025-12-01
CVE-2025-14874 [HIGH] Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
### Summary
A DoS can occur that immediately halts the system due to the use of an unsafe function.
### Details
According to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list.
However, the code implemented for this flattening process can be exploited by malicious input and triggers DoS
RFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a gr
GHSA
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
ghsa·2025-12-01
CVE-2025-14874 [HIGH] CWE-703 Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
### Summary
A DoS can occur that immediately halts the system due to the use of an unsafe function.
### Details
According to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list.
However, the code implemented for this flattening process can be exploited by malicious input and triggers DoS
RFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a gr
Red Hat
nodemailer: Nodemailer: Denial of service via crafted email address header
vendor_redhat·2025-12-01·CVSS 7.5
CVE-2025-14874 [HIGH] CWE-703 nodemailer: Nodemailer: Denial of service via crafted email address header
nodemailer: Nodemailer: Denial of service via crafted email address header
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Statement: This vulnerability is rated Moderate for Red Hat products that utilize Nodemailer, as a specially crafted email address header can trigger infinite recursion in the address parser. This can lead to a denial of service, causing the affected service to crash immediately. Exploitation does not require authentication and can be achieved with a single request.
Mi
Debian
CVE-2025-14874: node-nodemailer - A flaw was found in Nodemailer. This vulnerability allows a denial of service (D...
vendor_debian·2025·CVSS 7.5
CVE-2025-14874 [HIGH] CVE-2025-14874: node-nodemailer - A flaw was found in Nodemailer. This vulnerability allows a denial of service (D...
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 7.0.12+~7.0.5-1)
sid: resolved (fixed in 7.0.12+~7.0.5-1)
trixie: open
No detection rules found.
No public exploits indexed.
https://access.redhat.com/security/cve/CVE-2025-14874https://bugzilla.redhat.com/show_bug.cgi?id=2418133https://github.com/nodemailer/nodemailerhttps://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98vhttps://bugzilla.redhat.com/show_bug.cgi?id=2418133https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v
2025-12-18
Published